Application Brochure Version 01.00 R&S NESTOR-FOR Crime Scene Investigation NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 1 17.05.2018 15:52:33
Contents This application brochure describes the procedure for surveying telecommunications traces on the air interface in order to obtain information about the mobile radio cells at the scene of a crime. An R&S NESTOR measuring system can be used to substantively determine which mobile radio cells were able to connect to a mobile phone at a specific time and at a specific location. 1 Use case... 3 2 Preparing for measurement... 4 2.1 Configuring templates... 4 2.1.1 Modifying existing templates... 4 2.1.2 Creating templates... 5 2.2 Creating a workspace... 5 2.2.1 Saving new templates... 7 2.3 Saving workspaces... 8 3 Performing measurements... 9 4 Measurement evaluation/reports... 11 4.1 Loading measurement files... 11 4.2 Data analysis... 13 4.3 Reports... 17 Products from Rohde & Schwarz R&S NESTOR R&S TSME R&S TSMA R&S TSMW R&S MNT-CORE2 5 Ordering information... 19 6 Glossary... 19 2 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 2 17.05.2018 15:52:33
1 Use case Crime scene investigation (CSI) is a forensic use case that is supported by the R&S NESTOR software. It is performed for GSM, UMTS, LTE and CDMA2000 /EV-DO in a simultaneous measurement. Crime scene investigation is used to determine receivable mobile radio cells in the vicinity of one or more scenes of a crime. If one or more suspects had their mobile phones switched on at the time of the crime, this leaves activity traces in the mobile network. A list of cells receivable in the area(s) of interest (AOI) and a judicially ordered request for traffic data from network operators can be used to acquire information that is often helpful when investigating a crime. Submitting a request to the relevant network operator would be the simplest way to obtain all traffic data of the receivable radio cells in the AOI and is possible using the CSI use case in R&S NESTOR. With as many as hundreds of receivable cells theoretically under consideration, however, this increases the workload. For this reason, the number of cells to be queried is often reduced to the cells most probably used for mobile communications, which decreases the effort. On the other hand, in some cases, depending on the legal situation, querying an indefinitely large number of cells will not always be approved. R&S NESTOR therefore makes it possible to reduce the cells to be queried to a maximum number that have minimum values with regard to received power, ranking in the cell reselection or level offset from the best-server cell. The R&S NESTOR software warns the user when, due to excessive restrictions, cells that were best-server cells in the AOI at least one time are not considered. A list that is sorted according to decreasing probability and that enables quick assessment is available at all times. The following is a description of an exemplary work procedure, starting from measurement preparation and ending with the printout of a report containing the data needed for a request. CDMA2000 is a registered trademark of the Telecommunications Industry Association (TIA-USA). Rohde & Schwarz R&S NESTOR-FOR Crime Scene Investigation 3 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 3 17.05.2018 15:52:33
2 Preparing for measurement The R&S NESTOR software uses templates and work spaces for configuring measurements. Workspaces use templates with the settings that were active when the workspace was created. In other words, if configurations stored in the templates need to be permanently modified, it is advisable to make the relevant changes prior to creating the workspaces. Subsequent updates to the templates have no effect on existing workspaces. These workspaces must be manually updated. The advantage is that once workspaces have been created, they contain exactly the settings specified by the user at the time of storage, regardless of the measuring system used. 2.1 Configuring templates Template configuration is performed for the supplied standard templates or for user-specific versions based on the standard templates. 2.1.1 Modifying existing templates Use Settings/Templates to select the template to be modified (Fig. 1). User-specific templates can be recognized by the delete icon next to them. Standard templates can only be modified; they cannot be deleted. In the opened template, the tabs on the right can be used to modify the individual parameters for the analysis (Fig. 2). Specific user wishes may require significant changes to the standard settings and directly affect the amount of cell data to be requested. Fig. 1. Fig. 2. 4 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 4 17.05.2018 15:52:33
In some cases, the specifications must be adapted for each specific mobile radio technology (GSM, UMTS, LTE). 2.1.2 Creating templates Templates are created when the workspace is created; see section below. Fig. 3. 2.2 Creating a workspace The workspace editor is used to create workspaces (Fig. 3). Here, new workspaces can be created or existing workspaces modified (Fig. 4). Clicking the name of a new workspace opens another menu (Fig. 5) where the name can be entered. Fig. 4. Depending on the options that were purchased, the available use cases can be selected (Fig. 6). Here, CSI is the correct choice. Depending on the available mobile radio technologies to be analyzed at the scene of the crime, the CSI use case can have multiple choices with the corresponding templates (Fig. 7). Fig. 5. Fig. 6. Fig. 7: The selected templates appear on the right side of the screen in the list of active use cases. Use the arrow to the right of Active Use Cases to continue, or directly click the desired use case (Fig. 8). Rohde & Schwarz R&S NESTOR-FOR Crime Scene Investigation 5 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 5 17.05.2018 15:52:33
In the crime scene investigation area, the measurement parameters can be configured for the appropriate frequency range (Fig. 9). This is where the parameters from the templates are displayed. They can be modified if necessary. Unsaved changes are shown on the tab and can be confirmed by clicking the Apply button (Fig. 10). Fig. 8. Fig. 9. Fig. 10. 6 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 6 17.05.2018 15:52:34
If the parameters have not been defined in the standard templates, they can now be entered and saved for the scanner (Fig. 11). Here, the channels to be measured can be specified for each technology (RAT) to be monitored. Alternatively, the R&S NESTOR-ACD option can be used for automatic channel configuration. Recommendation: When lacking information about the level of development of mobile radio networks in the area of interest, it is advisable to configure the scanner using automatic cell detection (ACD). This is preset in the standard templates. In this case, ACD must also be included in the workspace as a use case. The scanner specifications are maintained individually for each technology (RAT). ACD should be used with a template that includes all relevant technologies that can be used with ACD. 2.2.1 Saving new templates Use Save/Save Template to store the modified settings on the local R&S NESTOR system for subsequent access. The only way to transfer the settings to other measuring systems is via a workspace (Fig. 12). Fig. 11. Fig. 12. Rohde & Schwarz R&S NESTOR-FOR Crime Scene Investigation 7 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 7 17.05.2018 15:52:34
2.3 Saving workspaces Use Save/Save Workspace to store modified work spaces on the local R&S NESTOR system. Use the arrow (Fig. 13, top) to access the save/export area (Fig. 14). Here, the created workspace can be saved either locally or to external data carriers. The workspace can be added to the user's favorite workspaces (Fig. 14). The current workspace can also be deleted from the local R&S NESTOR system so that it remains saved only on a USB stick, network drive or desktop. Then, however, using the workspace on the local R&S NESTOR system will require access to the selected storage location and it will no longer appear in the R&S NESTOR workspace tiles. Click the arrow to return to the dashboard. Further steps can now be carried out on the local R&S NESTOR system or a remote measuring system. Fig. 13. Fig. 14. 8 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 8 17.05.2018 15:52:35
3 Performing measurements To perform a measurement, select the Mobile Network Survey scenario after launching the R&S NESTOR software (Fig. 15). Check that at least one connected instrument is displayed (typically an R&S TSME or R&S TSMA scanner) (Fig. 16). Now, select the workspace that was created as described under 2.2 Creating a workspace (Fig. 17). Fig. 15. Fig. 16. Fig. 17. Rohde & Schwarz R&S NESTOR-FOR Crime Scene Investigation 9 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 9 17.05.2018 15:52:35
This loads the defined use cases and all settings relevant to the measurement. If the workspace and/or its templates are also to be permanently stored on the remote measuring system, follow the steps as described above ( 2.3 Saving workspaces ) (Fig. 18). In the display for the current measurement, the frequency of measurement at a specific position (bin) can be recognized from the color code (Fig. 19). To obtain a meaningful evaluation, at least two complete measurement cycles (green: standard display) should be performed in each geographic tile (bin, square). The actual number of measurement cycles can be checked by clicking each tile. Around the crime scene to be investigated, a very high percentage of tiles should be shown in green. Click HOME twice to end the measurement. Fig. 18. Fig. 19. 10 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 10 17.05.2018 15:52:35
4 Measurement evaluation/reports Click Data Investigation from among the scenarios to evaluate the measurement results (Fig. 20). Note: The measurement file must be present on the analysis system. 4.1 Loading measurement files During the subsequent file selection, the appropriate measurement file(s) are marked (Fig. 21). If no file(s) are displayed, configure the paths used for file storage under Add new data source.... Fig. 20. All use cases contained in the selected measurement files are shown on the right under Matched Use Cases (Fig. 22). Fig. 21. Fig. 22. Rohde & Schwarz R&S NESTOR-FOR Crime Scene Investigation 11 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 11 17.05.2018 15:52:36
There, the desired use cases can be clicked (Fig. 23). Note: If the analysis is to be performed for multiple files with different templates, group these use cases using the Organize button. In case of templates with the same name, R&S NESTOR automatically merges these use cases. To perform the analysis separately for different locations, however, the templates should be given different names (e.g. according to the scene of the crime). If the data from other use cases can be used for the use case currently under consideration, this data is displayed in the current use case and can be arranged with the Organize button. Previous use cases are shown in brackets before the technology (Fig. 23). For example, this procedure can be useful for analyzing multiple files with different measured use cases. In case of a single file with multiple measured use cases, the basic data for the different use cases is identical so that selection or grouping of multiple use cases only increases the analysis time without providing any additional information. Click the arrow at the top right (Fig. 23, right side) to access the analysis interface (Fig. 24). Fig. 23. 12 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 12 17.05.2018 15:52:36
4.2 Data analysis This view provides an overview of the measurement. The measurement can be filtered to individual operators by using the buttons to the left of the overview. There is a list view of the cells under Measured Cells in Aoi. By default, R&S NESTOR uses the surveyed route as the AOI. If the user wishes to survey one or more specific locations, this can be configured via Details/Polygons in the map display (R&S MapView) (Fig. 25). Fig. 24. Fig. 25. Rohde & Schwarz R&S NESTOR-FOR Crime Scene Investigation 13 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 13 17.05.2018 15:52:37
The cell list then changes based on the currently selected AOI (Fig. 26). Use the Analysis button at the bottom right to modify the thresholds for the analysis (Fig. 27). Attention: The above settings can be individually selected for each technology (GSM, UMTS, LTE). Without any modification, the analysis is performed in accordance with the specifications in the standard template. Ideally, the user should make any necessary modifications at the beginning ( 2.1.1 Modifying existing templates ). Fig. 26. Fig. 27. 14 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 14 17.05.2018 15:52:38
Use the buttons on the left to filter by network operator. The cells are listed according to the most probable use and possible restrictions due to legal regulations pertaining to requests for telecommunications data (max. cell number) (Fig. 28). The CSI map shows e.g. whether all top 1 cells are requestable and displays the best-server cell for the specific AOI. If the light green bar is smaller than the dark green bar, cells detected as usable (regardless of their list ranking) are not included in the report. If the green pie diagram is not completely filled, a cell that was the top 1 cell in a geographic bin within the AOI at least once is not included the report, due to the corresponding restriction made in the analysis settings. Fig. 28. Rohde & Schwarz R&S NESTOR-FOR Crime Scene Investigation 15 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 15 17.05.2018 15:52:38
As a result, cells that a suspect could have potentially used might not be queried (Fig. 29). Once the analysis has been performed in accordance with the settings made to provide meaningful results, click the arrow in the top right corner (Fig. 30) to access the Report Templates view. Fig. 29. Fig. 30. 16 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 16 17.05.2018 15:52:38
4.3 Reports To create a report for a CSI use case, it is advisable to use the Report Templates view (Fig. 31). Here, the installed templates are displayed. CrimeReport is the default setting, via which the cells determined in the analysis are output (Fig. 32). Fig. 31. Fig. 32. Rohde & Schwarz R&S NESTOR-FOR Crime Scene Investigation 17 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 17 17.05.2018 15:52:39
Clicking Save to File exports and saves the data as an XLS, CSV or XML document (Fig. 33). The export directory is indicated in the Successfully saved... notification. It can be modified by the user (Fig. 34). The default directory is C:\Users\%USERNAME%\ Documents\NESTOR\Exports. User-defined report templates are created with an XML editor. The CSI use case is now complete; the data is available for further processing. Fig. 33. Fig. 34. 18 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 18 17.05.2018 15:52:39
5 Ordering information Designation Type Order number Mobile Network Survey Software (SL) R&S NESTOR 1522.8870.02 Software Updates for One Year (four updates) R&S NESTOR-1Y 1522.8870.82 R&S NESTOR option: Driver for Rohde & Schwarz mobile network scanners (SL) R&S NESTOR option: Automatic Cell Detection (SL) R&S NESTOR-SCN 1521.5031.02 R&S NESTOR-ACD 1521.5048.02 R&S NESTOR option: Forensic Analysis (SL) R&S NESTOR-FOR 1521.5060.02 Mobile Network Testing (MNT) Backpack System R&S MNT-CORE2 1531.1200.02 Ultracompact Drive Test Scanner R&S TSME 1514.6520.02 Autonomous Mobile Network Scanner R&S TSMA 1514.6520.20 Universal Radio Network Analyzer R&S TSMW 1503.3001.03 R&S TSPC-SF4P 3623.3981.02 Controller SurfacePro 4 Tablet with Windows 10 6 Glossary ACD Automatic cell detection; automatically detects occupied bands and channels for GSM, UMTS, LTE and CDMA2000 /EV-DO AOI Area of interest; location where radio measurements are to be performed CSI Crime scene investigation; use case for investigating the scene of a crime by surveying the receivable radio cells RAT Radio access technology (e.g. GSM, UMTS, LTE) Rohde & Schwarz R&S NESTOR-FOR Crime Scene Investigation 19 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 19 17.05.2018 15:52:39
Service that adds value Worldwide Local and personalized Customized and flexible Uncompromising quality Long-term dependability About Rohde & Schwarz The Rohde & Schwarz electronics group offers innovative solutions in the following business fields: test and measurement, broadcast and media, secure communications, cybersecurity, monitoring and network testing. Founded more than 80 years ago, the independent company which is headquartered in Munich, Germany, has an extensive sales and service network with locations in more than 70 countries. Sustainable product design Environmental compatibility and eco-footprint Energy efficiency and low emissions Longevity and optimized total cost of ownership Certified Quality Management ISO 9001 Certified Environmental Management ISO 14001 Rohde & Schwarz GmbH & Co. KG www.rohde-schwarz.com Rohde & Schwarz training www.training.rohde-schwarz.com R&S is a registered trademark of Rohde & Schwarz GmbH & Co. KG Trade names are trademarks of the owners PD 5215.7116.92 Version 01.00 May 2018 (sk) R&S NESTOR-FOR Crime Scene Investigation Data without tolerance limits is not binding Subject to change 2018 Rohde & Schwarz GmbH & Co. KG 81671 Munich, Germany 5215.7116.92 01.00 PDP 1 en Regional contact Europe, Africa, Middle East +49 89 4129 12345 customersupport@rohde-schwarz.com North America 1 888 TEST RSA (1 888 837 87 72) customer.support@rsa.rohde-schwarz.com Latin America +1 410 910 79 88 customersupport.la@rohde-schwarz.com Asia Pacific +65 65 13 04 88 customersupport.asia@rohde-schwarz.com China +86 800 810 82 28 +86 400 650 58 96 customersupport.china@rohde-schwarz.com 5215711692 NESTOR-FOR_Crime_app-bro_en_5215-7116_92_v0100.indd 20 17.05.2018 15:52:39